Each step in the chain was, on its own, a command a developer would type without thinking. A classifier judging one command at a time saw curl pulling down a file, and later saw python running a script the agent had just written itself [3][4]. Nothing in either command string reads as hostile. The malice sat in the working directory, in a file called struct.py, and Python's import order did the rest [3].
Claude's one defensive instinct is what routed it into the trap. It declined to execute the unknown binary bundled in the archive, which is the right call, and wrote its own decoder instead. That decoder imported base64, base64 needs struct, and the interpreter found the attacker's copy in the local directory ahead of the standard library's, which was enough for remote code execution and a callback to a command-and-control server [4].
Then the two numbers. Anthropic's 0.00% attack success rate came from third-party red teaming across 72 fixed scenarios [6]. Zero out of 72 means the finest non-zero rate that suite can report is one in 72, roughly 1.4% [1]. Rehberger's chain was not one of the 72 [6], and he reports it landing 60% to 80% of the time across variants [5], which works out to between 1.25 and 1.67 attempts per success [2]. Both figures can be accurate at once, and only the second is measuring an attacker who improvises.
The detail to carry into a rollout meeting is the cleanup. When Claude worked out that something had gone wrong and moved to undo it, Auto Mode's own approval system blocked the command [7]. Permissive on the way in and restrictive on the way out, which leaves the artifact on the host and the remediation with a human who has to notice it first.
Anthropic closed the report as "Informative" rather than a bug to patch, on the stated position that Auto Mode is a best-effort classifier and that the boundary that counts is OS-level isolation plus control of network egress [8]. That is worth taking at face value, because the vendor is telling customers the containment is their job [10]. Mitch Ashley of The Futurum Group notes that agents are turning up well beyond developer IDEs and command line tools, into planning work, infrastructure management and operational monitoring [9]. Those places inherit the same import path and the same ambient credentials.
So, a forcing function with two axes. Down one side, whether the agent process holds real credentials: cloud keys, a live SSH agent, a logged-in CLI token, a keychain it can read. Across the other, whether it can open outbound connections to anywhere it likes. Default Auto Mode is defensible only in the quadrant where both answers are no [2]. Where credentials are present and egress is open, a summarize request is a shell an attacker rents by publishing a file. Most teams sit somewhere in between, one container and one egress allowlist away from the quadrant they can defend on Friday.
